1. Field of the Invention
The present invention relates generally to secure communication systems and more specifically to distributing key information using quantum cryptography which is unconditionally secure against eavesdropping.
2. Description of the Related Art
Quantum cryptography is known as the powerful technique for secure communication, because it provides unconditional security for distribution of secret key information between remote users. Quantum cryptographic key distribution consists of two parts: quantum information transmissions between legitimate users over a quantum channel and classical information transmission between the legitimate users over a public channel. Any activities of eavesdroppers are detected from the measured results of the two kinds of transmissions, which is ensured from the principles of quantum mechanics such as Heisenberg""s uncertainty principle and violation of the Bell theorem. The protocol describes a process whereby the legitimate users determine a secret key while confirming that no eavesdropping is taking place. The security of the secret key is guaranteed by the uncertainty principle whereby disturbance is introduced in the quantum information by any eavesdropping attempt, and hence unconditional security against any wiretapping is achieved. By combining quantum cryptography With a one-time-pad scheme, an unconditional secure communication can be implemented.
A variety of protocols have been proposed so far, for example, the four-state scheme, the two-photon interferometric scheme, the nonorthogonal two-state scheme and the delayed interferometric transmission scheme. One measure of the performance of a protocol is the sensitivity to eavesdropping (specifically, it represents the precision of the amount of information leakage to an eavesdropper determined from the data bit error). Another measure is the data transmission rate which is determined by the reduction of data being discarded or sacrificed for detecting eavesdropping during the protocol. It has been found from the current study that the four-state quantum scheme and the two-photon interferometric scheme are better because of their high sensitivity to eavesdropping and high transmission rate.
The four-state scheme is the first one of the protocols invented. As described in Proceedings of the IEEE International Conference on Computers, Systems and Signal Processing, Bangalore, India (IEEE, New York, 1984), C. H. Bennet and G. Brassard, pages 175-179 (Reference 1), the four-state scheme (currently known as the BB84 protocol) uses a single-photon source 10 (see FIG. 1) to produce a pulsed photon carrier 11 for carrying one bit of information, a light modulator 12, an optical channel 13 for conveying the modulated photon carrier 11, and a public channel 16 (for which an eavesdropper can access, but cannot alter transmitted messages) for exchanging classical messages between two legitimate users at the sender and receiver sites to test the correlation of the data sent and those actually received. Light modulator 12 modulates the photon carrier 11 and encodes random bit sequence consisting of a bit xe2x80x9c0xe2x80x9d and a bit xe2x80x9c1xe2x80x9d produced from a controller 15 onto the photon carrier 11 so that bits xe2x80x9c0xe2x80x9d and xe2x80x9c1xe2x80x9d are encoded by two orthogonal polarisation states of a photon. Two nonorthogonal polarisation bases (oil is linear polarisations of 0xc2x0 and 90xc2x0 rectilinear basis, and the other is linear polarisations of 45xc2x0 and 135xc2x0; diagonal basis) are used to encode the xe2x80x9c0xe2x80x9d and xe2x80x9c1xe2x80x9d. Logical xe2x80x9c0xe2x80x9d and xe2x80x9c1xe2x80x9d are encoded with the 0xc2x0 and 90xc2x0 polarisations respectively (for rectilinear basis) and the 45xc2x0 and 135xc2x0 polarisations respectively (for diagonal basis). Circular polarisations (clockwise and counterclockwise) may be used, instead of one of these two polarisation bases (rectilinear basis or diagonal basis).
Since the 0xc2x0 polarisations state and 90xc2x0 polarisation state are orthogonal, photons with such polarisations can be reliably distinguished. A single measurement device 14 at the receiver site that has the ability to distinguish such polarisations is called a rectilinear measurement device. Likewise, photons with 45xc2x0-135xc2x0 linear polarisation can he reliably distinguished by another single measurement device 14 that is called a diagonal measurement device. Quantum mechanical operator, having the eigenstates of rectilinear polarisation states and those having the eigenstate of diagonal basis are non-commuting. Thus, the rectilinear measurement device cannot distinguish the state of the photons which are in the eigenstate of diagonal basis and the diagonal measurement device cannot distinguish the state of the photons which are in the eigenstate of rectilinear basis (they will produce an error with a probability of xc2xd). In particular, when a light pulse contains only one photon, these measurement devices cannot distinguish the state of the photons which are in the eigenstate of rectilinear basis and the state of the photons which are in the eigenstate diagonal basis at the same time (that is the uncertainty principle). The output of the measurement device 14 is supplied to a controller 17.
The basis (rectilinear basis or diagonal basis) are chosen at random at the sender site when encoding the bit onto the photon carrier. At the receiver site, the basis are also chosen at random independently of the sender site when decoding the modulated carrier. After transmissions of quantum information encoded in the photon carriers over the quantum channel 13, messages are exchanged over the public channel 16 between the controllers 15 and 17 to test whether both users used the same linear polarisation basis to transmit and receive the data. They discard the data that the legitimate users used a different basis to encode and decode the bit data. The bit value of the remaining data should agree for both legitimate users and are used to obtain the shared key data. An eavesdropper, having no means at all to match his/her polarisation basis to those chosen at the sender and receiver, inevitably produces an error in the shared bit sequence of the legitimate users when he/she attempts to measure the photons to eavesdrop the data. Several bits are then extracted from the shared bit sequence at each site and tested whether they agree by exchanging information over the public channel to determine if eavesdropping is taking place. If the extracted data agreed then the legitimate users find that there is no eavesdropping, and they produce a sequence of common random bits from the remaining data that were not used for this test and use these common random bits as a secret key.
The BB84 protocol is based on the uncertainty principle that in a single quantum system two sets of mutually nonorthogonal bases cannot he measured with certainty at the same time. A given orthogonal basis (e.g., the diagonal basis) can be always represented by a superposition of another basis nonorthogonal to it (e.g., the rectilinear basis). A measurement that can reliably distinguish a given basis would inevitably destroy the superposition state of a given basis (that is, nonorthogonal basis) and cause it to collapse to a given basis. More generally, a measurement that can partially distinguish a given basis would partially destroy the superposition state of given basis and the state after measurement approaches statistical mixture of a given basis.
It is shown in Physical Review Vol. A 56, No. 2, August 1997, Christopher A. Fuchs at al., pages 1163 to 1172 (hereinafter Reference 2) that the BB84 protocol is equivalent to a procedure in which the presence of an eavesdropper is detected through the collapse of quantum mechanical superposition. Reference 2 shows that the two-photon interferometric scheme is as strong as the four-state quantum cryptography. This two-photon interferometric scheme, known as the E91 protocol, uses the so-called Einstein-Podolsky-Rosen correlation, that is, non-local correlation in the non-separable quantum state of composite system, see Physical Review Letters Vol. 67, No. 6, August 1991, Artur K. Eckert, pages 661 to 663, (Reference 3), and Physical Review Letters Vol. 69, No. 9, August 1992, Artur K. Eckert, pages 1293 to 1295 (Reference 4). In addition, Physical Review Letters Vol. 81, No. 14, October 1998, Dagmar Bruss, pages 3018 to 3021, Reference 5, indicates that the security of quantum cryptography can be further increased by using a set of three different pairs of two orthogonal Basis states (i.e., a total of six states) for encoding the data.
A s It has hitherto been believed that it is required that the measured system must be comprised by single quanta for a measurement with wrong basis to cause disturbance to a quantum mechanical superposition state. However, it is not a true requirement, but quantum mechanics allows the system to contain more than single quanta (photon) to be affected by the uncertainty principle. As will be described later, the present invention is based on the utilization of mesoscopic quantum mechanical states where the measured system, i.e. carriers, comprises multiple quanta or photons.
The two-state scheme, known as the B92 protocol, is described in Physical Review Letters Volume 68, Number 21, May 1992, Charier. H. Bennett, pages 3121 to 3124 (hereinafter Reference 6) and Physical Review Volume 30, Number 2, August 1994, A. K. Eckert, B. Huttner, G. M. Palma and A. Peres, pages 1047 to 1056 (hereinafter Reference 7). As shown in simplified form in FIG. 2, Reference 6 discloses an interferometric quantum key distribution scheme in which the sender site uses beam-splitter 22 to split a low-intensity coherent light pulse 21 into light pulses 23 and 24. The light pulse 23 is modulated by a phase modulator 25 so that information bits xe2x80x9c0xe2x80x9d and xe2x80x9c1xe2x80x9d are encoded into 0xc2x0 and 180xc2x0 phase shift, respectively. The modulated light pulse 23 is launched into one arm (quantum channel) 26 and the non-modulated light pulse 24 is launched into the other arm (quantum channel) 27 of a Mach-Zehnder interferometer. At the receiver site, the light pulses 23 and 24 are combined by beam-splitter 28 to cause interference. The phase difference between light pulses 23 and 24 is controlled by a phase modulator 29 so that the xe2x80x9c0xe2x80x9d bit pulses are delivered to a photodetector 30 and the xe2x80x9c1xe2x80x9d bit pulses are delivered to a photodetector 31. In order that the probability of light pulse 23 having two or more photons is as small as possible, the average number of photons contained in the low-intensity coherent light pulse 21 must be much smaller than 1 (0.1, for example). In this way, a prospect eavesdropper is prevented from copying a light pulse and the nonorthogonality (overlap) of the 0xc2x0 and 180xc2x0 phase shifted states of the light pulse 21 increases. Since the intensity of light pulse 21 is sufficiently dim to realize the two nonorthogonal quantum states, the contribution of vacuum state in the light pulse 21 necessarily increases.
Because of the large contribution of the vacuum state, it can be conclusively determine whether the light pulses incident on the photodetectors 30 and 31 are bits xe2x80x9c0xe2x80x9d and xe2x80x9c1xe2x80x9d, respectively, although most of the time no photons are detected.
The B92 protocol relies on conclusive measurement of two nonorthogonal quantum states of this kind. According to the uncertainty principle, there exist no measurement that can unambiguously distinguish two nonorthogonal quantum states. Two nonorthogonal states can only be distinguished with a certain error probability. However, consider a measurement that allows three different outcomes to be gained from two nonorthogonal quantum states. If such a measurement is allowed, there exists a so-called unambiguous (conclusive) measurement that can give a unambiguous conclusion about some outcomes. For example, an measurement of two nonorthogonal quantum states A and B, three conclusions can be drawn in such a measurement: (i) state A cannot be true, (ii) state B cannot be true, and (iii) neither of these can be determined as true or false. If a given quantum state is none other than states A and B, these results are equivalent to the conclusions that (i) the state is unambiguously B, (ii) the state is unambiguously A, and (iii) neither of these can be determined. If conclusion (i) or (ii) is designated as xe2x80x9cconclusive resultsxe2x80x9d and conclusion (iii) as xe2x80x9cinconclusive resultsxe2x80x9d, it is only necessary for the receiver to tell the sender the fact that the results are conclusive or inconclusive in order to share information about the state unambiguously. The contents of the conclusions (i) and (ii) are not transmitted, but shared by the sender and the receiver. However, there is no correlation between what data are conclusive results and what data are inconclusive results between the legitimate receiver and the eavesdropper. Thus it is impossible for the eavesdropper to share the same information with the legitimate sender and receiver. Therefore, an eavesdropper cannot tap a quantum channel without causing errors in the shared bit stream. The sender and the receiver extract test bits from the shared bit stream using a public channel to check for errors and determine if unauthorised interception has occurred. If it is ascertained that no eavesdropping has occurred, a secret key is determined from the remaining, untested bits. Since this protocol requires low-intensity coherent light, the receiver suffers from frequent instances of inconclusive results of measurement of quantum states, resulting in a low transmission speed.
Although the four-state scheme (the BB84 protocol) and the low-photon interferometric scheme (the E91 protocol) are highly secure and have high transmission rate, they need to use single-photon transmission in which each pulse contains only a single photon to ensure secure communication. This requires devices that can be precisely controlled to generate a single-photon sequence. However, no practical single-photon source is implemented with the current technology. In this regard, Physical Review Volume 51, Number 3, March 1995, B. Huttner, N. Gisin and T. Mor, pages 1863 to 1869 (Reference 8) and Optics Communications 123, 1996, Yi Mu et al., pages 344 to 352 (Reference 9) discuss a practical four-state quantum cryptographic key distribution system using a combination of two nonorthogonal quantum states to artificially create a four-states. However, it is also necessary to reduce the average number of photons sufficiently to ensure high security for these systems. This is achieved only at the cost of transmission rate.
It is therefore an object of the present invention to provide a key distribution system using four-state coherent light pulses comprised of multiple photons that is improved over prior art systems in terms of security and data transmission rate.
In general terms, the present invention provides a secure communication network comprising a sender node for randomly selecting, a first coherent light pulse sequence encoded with a random bit sequence and a second coherent light pulse sequence containing a superposition of two coherent states and transmitting the randomly selected first and second sequences over an optical communication link. A receiver node is connected to the optical communication link for receiving the randomly selected fist and second sequences. The receiver node determines whether or not the received second light pulse sequence is destroyed with the aid of exchanging the classical messages after quantum transmission that specifies which are the second sequences among total transmitted sequences, and produces a key from the received random bit sequence from the first light pulse sequence if the second light pulse sequence is found not destroyed by an unauthorised interception. It is the key point that the random bit sequence is encoded as a pair of orthogonal quantum states and detection of eavesdropping is carried by a superposition of these orthogonal quantum states. The first light pulse sequence in which the random hit is encoded may be two high-intensity nearly orthogonal coherent states, and the second light pulse sequence may the a superposition of two coherent states. This superposition of coherent states collapsed to one of coherent state by a measurement that can decode the random bit encoded in the first light pulse sequence. It is also collapsed even if a measurement is made at a single quantum level.
In further specific terms, the secure communication network of the present invention comprise, a first light source for producing a first coherent light pulse sequence, a phase modulator for modulating the first coherent light pulse sequence with a random bit sequence, a second light source synchronised in phase to the first light source for producing a second coherent light pulse sequence, an optical transducer for converting quantum states of the second coherent light pulse sequence to superposition of coherent states, an optical switch for switching outputs of the phase modulator and the optical transducer into a temporally mixed light pulse sequence and transmitting the mixed light pulse sequence over an optical communication link, and a homodyne detector for receiving the transmitted light pulse sequence via the optical communication link and detecting a random bit sequence and a superposition state.
The homodyne detector may include a local light oscillator, phase control circuitry for controlling the phase of the local light oscillator so that it produces first and second local light having a phase difference of 90 degrees therebetween, and a beam-splitter for receiving light from the optical communication link and mixing the first coherent light pulse sequence with the first local light and mixing the second coherent light pulse sequence with the second local light.